vpixray 0.1.0__py3-none-any.whl

core/cmdi.py

@@ -0,0 +1,40 @@
+import re
+from urllib.parse import urlparse, parse_qs, urlencode, urlunparse
+from utils.colors import console
+
+CMDI_PAYLOADS = [
+    (";id", r"uid=\d+\("),
+    ("|id", r"uid=\d+\("),
+    ("`id`", r"uid=\d+\("),
+    ("$(id)", r"uid=\d+\("),
+    (";cat /etc/passwd", r"root:.*:0:0:"),
+    ("|whoami", r"(root|www-data|apache|nginx)"),
+]
+
+def check_cmdi(requester, url):
+    result = {"name": "Command Injection", "findings": [], "vulnerable": []}
+    parsed = urlparse(url)
+    params = parse_qs(parsed.query)
+    if not params:
+        console.print("[dim]    i No parameters found, skipping[/dim]")
+        return result
+    console.print(f"[info]  -> Testing {len(params)} param(s) with {len(CMDI_PAYLOADS)} payloads...[/info]")
+    for param in params:
+        console.print(f"[dim]    -> Param: {param}[/dim]")
+        for i, (payload, pattern) in enumerate(CMDI_PAYLOADS, 1):
+            q = params.copy()
+            q[param] = [params[param][0] + payload]
+            test_url = urlunparse(parsed._replace(query=urlencode(q, doseq=True)))
+            console.print(f"[dim]      [{i}/{len(CMDI_PAYLOADS)}] {payload!r}[/dim]")
+            resp = requester.get(test_url)
+            if resp and re.search(pattern, resp.text):
+                console.print(f"[vuln]    !! Command Injection via {param}![/vuln]")
+                result["vulnerable"].append({"param": param, "payload": payload})
+                result["findings"].append({
+                    "severity": "critical",
+                    "msg": f"Command Injection via param: {param} (payload: {payload})",
+                })
+                break
+    if not result["vulnerable"]:
+        console.print("[success]    + No command injection found[/success]")
+    return result

core/cors.py

@@ -0,0 +1,38 @@
+from utils.colors import console
+
+def check_cors(requester, url):
+    result = {"name": "CORS Misconfig", "findings": [], "vulnerable": []}
+    console.print("[info]  -> Sending requests with crafted Origin headers...[/info]")
+
+    origins = [
+        "https://evil.example.com",
+        "null",
+        "http://localhost",
+    ]
+
+    for origin in origins:
+        console.print(f"[dim]    -> Testing Origin: {origin}[/dim]")
+        resp = requester.get(url, headers={"Origin": origin})
+        if not resp:
+            continue
+        acao = resp.headers.get("Access-Control-Allow-Origin", "")
+        acac = resp.headers.get("Access-Control-Allow-Credentials", "")
+
+        if acao == "*":
+            console.print(f"[warn]    ! CORS wildcard * (no credentials)[/warn]")
+            result["findings"].append({
+                "severity": "low",
+                "msg": "CORS allows wildcard origin (*) — low risk without credentials",
+            })
+        elif acao == origin:
+            sev = "high" if acac.lower() == "true" else "medium"
+            console.print(f"[vuln]    !! CORS reflects Origin: {origin} (credentials: {acac})[/vuln]")
+            result["vulnerable"].append({"origin": origin, "credentials": acac})
+            result["findings"].append({
+                "severity": sev,
+                "msg": f"CORS reflects origin '{origin}' (credentials: {acac or 'none'})",
+            })
+
+    if not result["findings"]:
+        console.print("[success]    + CORS properly configured[/success]")
+    return result

core/crlf.py

@@ -0,0 +1,40 @@
+from urllib.parse import urlparse, parse_qs, urlencode, urlunparse
+from utils.colors import console
+
+CRLF_PAYLOADS = [
+    "%0d%0aInjected-Header: vpixray-test",
+    "%0aInjected-Header: vpixray-test",
+    "%0d%0a%0d%0a<html>injected</html>",
+]
+
+def check_crlf(requester, url):
+    result = {"name": "CRLF Injection", "findings": [], "vulnerable": []}
+    parsed = urlparse(url)
+    params = parse_qs(parsed.query)
+    if not params:
+        console.print("[dim]    i No parameters found, skipping[/dim]")
+        return result
+    console.print(f"[info]  -> Testing {len(params)} param(s) with {len(CRLF_PAYLOADS)} payloads...[/info]")
+    for param in params:
+        console.print(f"[dim]    -> Param: {param}[/dim]")
+        for i, payload in enumerate(CRLF_PAYLOADS, 1):
+            console.print(f"[dim]      [{i}/{len(CRLF_PAYLOADS)}] Testing...[/dim]")
+            q = params.copy()
+            q[param] = [payload]
+            # نبني URL يدويًا لأن urlencode يشوّه %0d%0a
+            query = "&".join(f"{k}={v[0]}" for k, v in q.items())
+            test_url = urlunparse(parsed._replace(query=query))
+            resp = requester.get(test_url)
+            if not resp:
+                continue
+            if "vpixray-test" in resp.headers or "Injected-Header" in str(resp.headers):
+                console.print(f"[vuln]    !! CRLF Injection via {param}![/vuln]")
+                result["vulnerable"].append({"param": param, "payload": payload})
+                result["findings"].append({
+                    "severity": "high",
+                    "msg": f"CRLF Injection via param: {param}",
+                })
+                break
+    if not result["vulnerable"]:
+        console.print("[success]    + No CRLF injection found[/success]")
+    return result

core/csrf.py

@@ -0,0 +1,35 @@
+from bs4 import BeautifulSoup
+from utils.colors import console
+
+def check_csrf(requester, url):
+    result = {"name": "CSRF", "findings": [], "vulnerable": []}
+    console.print("[info]  -> Scanning for forms...[/info]")
+    resp = requester.get(url)
+    if not resp:
+        console.print("[error]    x Connection failed[/error]")
+        return result
+    soup = BeautifulSoup(resp.text, "html.parser")
+    forms = soup.find_all("form")
+    console.print(f"[dim]    Found {len(forms)} form(s)[/dim]")
+    for i, form in enumerate(forms, 1):
+        action = form.get("action", "")
+        method = form.get("method", "GET").upper()
+        inputs = form.find_all("input")
+        has_token = False
+        for inp in inputs:
+            name = (inp.get("name") or "").lower()
+            if "token" in name or "csrf" in name or "_token" in name:
+                has_token = True
+                break
+        if method == "POST" and not has_token:
+            console.print(f"[vuln]    !! Form #{i} POST without CSRF token[/vuln]")
+            result["vulnerable"].append({"form": i, "action": action, "method": method})
+            result["findings"].append({
+                "severity": "medium",
+                "msg": f"POST form without CSRF token (action: {action or 'same page'})",
+            })
+        else:
+            console.print(f"[success]    + Form #{i} OK ({method}, token: {has_token})[/success]")
+    if not result["vulnerable"]:
+        console.print("[success]    + No CSRF issues found[/success]")
+    return result

core/dirlisting.py

@@ -0,0 +1,31 @@
+from utils.colors import console
+
+COMMON_DIRS = [
+    "/", "/images/", "/uploads/", "/files/", "/backup/",
+    "/admin/", "/assets/", "/static/", "/css/", "/js/",
+    "/logs/", "/tmp/", "/data/",
+]
+
+def check_dirlisting(requester, base_url):
+    result = {"name": "Directory Listing", "findings": [], "vulnerable": []}
+    base = base_url.rstrip("/")
+    console.print(f"[info]  -> Testing {len(COMMON_DIRS)} directories...[/info]")
+
+    for i, path in enumerate(COMMON_DIRS, 1):
+        url = f"{base}{path}"
+        console.print(f"[dim]    [{i}/{len(COMMON_DIRS)}] {path}[/dim]")
+        resp = requester.get(url)
+        if not resp or resp.status_code != 200:
+            continue
+        body = resp.text.lower()
+        if "<title>index of" in body or "<h1>index of" in body:
+            console.print(f"[vuln]    !! Directory listing enabled: {path}[/vuln]")
+            result["vulnerable"].append({"path": path})
+            result["findings"].append({
+                "severity": "medium",
+                "msg": f"Directory listing enabled: {path}",
+            })
+
+    if not result["vulnerable"]:
+        console.print("[success]    + No directory listing found[/success]")
+    return result

core/fingerprint.py

@@ -0,0 +1,38 @@
+import re
+from utils.colors import console
+
+TECH_SIGNATURES = {
+    "WordPress":  [r"wp-content", r"wp-includes"],
+    "Joomla":     [r"/components/com_", r"joomla"],
+    "Drupal":     [r"sites/default/files", r"Drupal"],
+    "React":      [r"__REACT_DEVTOOLS", r"react-dom"],
+    "Vue.js":     [r"vue\.js", r"__vue__"],
+    "Angular":    [r"ng-version", r"angular"],
+    "jQuery":     [r"jquery(\.min)?\.js"],
+    "Bootstrap":  [r"bootstrap(\.min)?\.(css|js)"],
+    "Nginx":      [r"nginx"],
+    "Apache":     [r"apache"],
+    "Cloudflare": [r"cloudflare"],
+    "PHP":        [r"X-Powered-By:\s*PHP", r"PHPSESSID"],
+    "ASP.NET":    [r"ASP\.NET", r"X-AspNet-Version"],
+    "Django":     [r"csrftoken", r"django"],
+}
+
+def check_fingerprint(requester, url):
+    console.print("[info]  -> Analyzing server response...[/info]")
+    result = {"name": "Tech Fingerprint", "findings": [], "technologies": []}
+    resp = requester.get(url)
+    if not resp:
+        console.print("[error]    x Connection failed[/error]")
+        return result
+    haystack = resp.text + "\n" + "\n".join(f"{k}: {v}" for k, v in resp.headers.items())
+    for tech, patterns in TECH_SIGNATURES.items():
+        for pat in patterns:
+            if re.search(pat, haystack, re.IGNORECASE):
+                console.print(f"[success]    + Detected: {tech}[/success]")
+                result["technologies"].append(tech)
+                result["findings"].append({"severity": "info", "msg": f"Detected: {tech}"})
+                break
+    if not result["technologies"]:
+        console.print("[dim]    i No known technologies detected[/dim]")
+    return result

core/headers_check.py

@@ -0,0 +1,38 @@
+from utils.colors import console
+
+SECURITY_HEADERS = {
+    "Strict-Transport-Security": "Enforces HTTPS",
+    "Content-Security-Policy":   "Mitigates XSS",
+    "X-Frame-Options":           "Prevents Clickjacking",
+    "X-Content-Type-Options":    "Prevents MIME sniffing",
+    "Referrer-Policy":           "Controls referrer leakage",
+    "Permissions-Policy":        "Restricts browser features",
+    "Cross-Origin-Opener-Policy":"Isolates windows",
+    "Cross-Origin-Resource-Policy":"Blocks cross-origin loads",
+}
+
+def check_headers(requester, url):
+    console.print("[info]  -> Fetching HTTP headers...[/info]")
+    result = {"name": "Security Headers", "findings": [], "missing": [], "score": 0}
+    resp = requester.get(url)
+    if not resp:
+        console.print("[error]    x Connection failed[/error]")
+        result["findings"].append({"severity": "info", "msg": "Could not connect"})
+        return result
+    console.print("[dim]    OK Response received, analyzing...[/dim]")
+    present = 0
+    lower_keys = {k.lower() for k in resp.headers.keys()}
+    for header, desc in SECURITY_HEADERS.items():
+        if header.lower() in lower_keys:
+            console.print(f"[success]    + {header}[/success]")
+            present += 1
+        else:
+            console.print(f"[warn]    - {header} MISSING[/warn]")
+            result["missing"].append({"header": header, "desc": desc})
+    result["score"] = int((present / len(SECURITY_HEADERS)) * 100)
+    if result["missing"]:
+        result["findings"].append({
+            "severity": "low" if result["score"] > 50 else "medium",
+            "msg": f"{len(result['missing'])} missing security headers (score: {result['score']}%)",
+        })
+    return result

core/hostheader.py

@@ -0,0 +1,29 @@
+from utils.colors import console
+
+def check_host_header(requester, url):
+    result = {"name": "Host Header Injection", "findings": [], "vulnerable": []}
+    console.print("[info]  -> Testing Host header manipulation...[/info]")
+
+    evil_hosts = [
+        "evil.example.com",
+        "localhost",
+    ]
+
+    for host in evil_hosts:
+        console.print(f"[dim]    -> Testing Host: {host}[/dim]")
+        resp = requester.get(url, headers={"Host": host})
+        if not resp:
+            continue
+        body = resp.text.lower()
+        if "evil.example.com" in body or host in body:
+            console.print(f"[vuln]    !! Host header reflected in response: {host}[/vuln]")
+            result["vulnerable"].append({"host": host})
+            result["findings"].append({
+                "severity": "high",
+                "msg": f"Host header '{host}' reflected in response (password reset poisoning risk)",
+            })
+            break
+
+    if not result["vulnerable"]:
+        console.print("[success]    + Host header not reflected[/success]")
+    return result

core/idor.py

@@ -0,0 +1,32 @@
+from urllib.parse import urlparse, parse_qs, urlencode, urlunparse
+from utils.colors import console
+
+def check_idor(requester, url):
+    result = {"name": "IDOR", "findings": [], "vulnerable": []}
+    parsed = urlparse(url)
+    params = parse_qs(parsed.query)
+    numeric_params = {k: v for k, v in params.items() if v and v[0].isdigit()}
+    if not numeric_params:
+        console.print("[dim]    i No numeric parameters found, skipping[/dim]")
+        return result
+    console.print(f"[info]  -> Testing {len(numeric_params)} numeric param(s) for IDOR...[/info]")
+    for param, values in numeric_params.items():
+        original_id = int(values[0])
+        console.print(f"[dim]    -> Param: {param} (id={original_id})[/dim]")
+        for test_id in [original_id - 1, original_id + 1, original_id + 100, 1, 0]:
+            if test_id < 0 or test_id == original_id:
+                continue
+            q = params.copy()
+            q[param] = [str(test_id)]
+            test_url = urlunparse(parsed._replace(query=urlencode(q, doseq=True)))
+            resp = requester.get(test_url)
+            if resp and resp.status_code == 200 and len(resp.text) > 100:
+                console.print(f"[warn]    ? Different response for {param}={test_id} (potential IDOR)[/warn]")
+                result["findings"].append({
+                    "severity": "medium",
+                    "msg": f"Possible IDOR via {param}={test_id} (manual verification needed)",
+                })
+                break
+    if not result["findings"]:
+        console.print("[success]    + No obvious IDOR found[/success]")
+    return result

core/jwt.py

@@ -0,0 +1,77 @@
+import base64
+import json
+import re
+from utils.colors import console
+
+JWT_REGEX = re.compile(r"eyJ[A-Za-z0-9_\-]+\.eyJ[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]*")
+
+def _b64decode_pad(s):
+    s += "=" * (-len(s) % 4)
+    try:
+        return base64.urlsafe_b64decode(s).decode("utf-8", errors="ignore")
+    except Exception:
+        return ""
+
+def check_jwt(requester, url):
+    result = {"name": "JWT Analyzer", "findings": [], "vulnerable": []}
+    console.print("[info]  -> Scanning for JWT tokens in response...[/info]")
+    resp = requester.get(url)
+    if not resp:
+        console.print("[error]    x Connection failed[/error]")
+        return result
+
+    # ندور في الرد والـ headers
+    haystack = resp.text + "\n" + "\n".join(f"{k}: {v}" for k, v in resp.headers.items())
+    tokens = set(JWT_REGEX.findall(haystack))
+
+    if not tokens:
+        console.print("[dim]    i No JWT tokens found[/dim]")
+        return result
+
+    console.print(f"[dim]    Found {len(tokens)} JWT token(s)[/dim]")
+
+    for token in tokens:
+        parts = token.split(".")
+        if len(parts) != 3:
+            continue
+
+        header = _b64decode_pad(parts[0])
+        payload = _b64decode_pad(parts[1])
+        console.print(f"[dim]    Header: {header[:100]}[/dim]")
+        console.print(f"[dim]    Payload: {payload[:100]}[/dim]")
+
+        try:
+            header_json = json.loads(header)
+            alg = header_json.get("alg", "").lower()
+        except Exception:
+            alg = ""
+
+        if alg == "none":
+            console.print("[vuln]    !! JWT with 'alg: none'![/vuln]")
+            result["findings"].append({
+                "severity": "critical",
+                "msg": "JWT uses 'alg: none' (signature bypass)",
+            })
+            result["vulnerable"].append({"issue": "alg_none"})
+
+        if alg in ("hs256", "hs384", "hs512"):
+            console.print(f"[warn]    ! JWT uses {alg.upper()} (test weak secret)[/warn]")
+            result["findings"].append({
+                "severity": "low",
+                "msg": f"JWT uses HMAC ({alg}) — test for weak secret",
+            })
+
+        try:
+            payload_json = json.loads(payload)
+            if "exp" not in payload_json:
+                console.print("[warn]    ! JWT has no expiration (exp)[/warn]")
+                result["findings"].append({
+                    "severity": "medium",
+                    "msg": "JWT has no 'exp' claim",
+                })
+        except Exception:
+            pass
+
+    if not result["findings"]:
+        console.print("[success]    + No JWT issues found[/success]")
+    return result

core/lfi.py

@@ -0,0 +1,49 @@
+import re
+from urllib.parse import urlparse, parse_qs, urlencode, urlunparse
+from utils.colors import console
+
+LFI_PAYLOADS = [
+    "../../../../etc/passwd",
+    "../../../../../../etc/passwd",
+    "....//....//....//etc/passwd",
+    "..%2F..%2F..%2F..%2Fetc%2Fpasswd",
+    "/etc/passwd",
+    "....//....//....//....//etc/passwd",
+]
+
+LFI_PATTERNS = [
+    r"root:.*:0:0:",
+    r"daemon:.*:1:1:",
+    r"\[boot loader\]",
+    r"\[extensions\]",
+]
+
+def check_lfi(requester, url):
+    result = {"name": "LFI", "findings": [], "vulnerable": []}
+    parsed = urlparse(url)
+    params = parse_qs(parsed.query)
+    if not params:
+        console.print("[dim]    i No parameters found, skipping[/dim]")
+        return result
+    console.print(f"[info]  -> Testing {len(params)} param(s) with {len(LFI_PAYLOADS)} payloads...[/info]")
+    for param in params:
+        console.print(f"[dim]    -> Param: {param}[/dim]")
+        for i, payload in enumerate(LFI_PAYLOADS, 1):
+            q = params.copy()
+            q[param] = [payload]
+            test_url = urlunparse(parsed._replace(query=urlencode(q, doseq=True)))
+            console.print(f"[dim]      [{i}/{len(LFI_PAYLOADS)}] {payload}[/dim]")
+            resp = requester.get(test_url)
+            if resp:
+                for pat in LFI_PATTERNS:
+                    if re.search(pat, resp.text):
+                        console.print(f"[vuln]    !! LFI via {param}![/vuln]")
+                        result["vulnerable"].append({"param": param, "payload": payload})
+                        result["findings"].append({
+                            "severity": "high",
+                            "msg": f"LFI via param: {param} (payload: {payload})",
+                        })
+                        return result
+    if not result["vulnerable"]:
+        console.print("[success]    + No LFI found[/success]")
+    return result

core/nosqli.py

@@ -0,0 +1,51 @@
+from urllib.parse import urlparse, parse_qs, urlencode, urlunparse
+from utils.colors import console
+
+NOSQL_ERRORS = [
+    "mongoerror",
+    "mongo",
+    "$where",
+    "unexpected token",
+    "json parse error",
+    "cast to objectid failed",
+]
+
+NOSQL_PAYLOADS = [
+    '{"$ne": null}',
+    '{"$gt": ""}',
+    "' || '1'=='1",
+    '"; return true; var x="',
+    "[$ne]=1",
+]
+
+def check_nosqli(requester, url):
+    result = {"name": "NoSQL Injection", "findings": [], "vulnerable": []}
+    parsed = urlparse(url)
+    params = parse_qs(parsed.query)
+    if not params:
+        console.print("[dim]    i No parameters found, skipping[/dim]")
+        return result
+    console.print(f"[info]  -> Testing {len(params)} param(s) with {len(NOSQL_PAYLOADS)} payloads...[/info]")
+    for param in params:
+        console.print(f"[dim]    -> Param: {param}[/dim]")
+        for i, payload in enumerate(NOSQL_PAYLOADS, 1):
+            console.print(f"[dim]      [{i}/{len(NOSQL_PAYLOADS)}] {payload[:40]}[/dim]")
+            q = params.copy()
+            q[param] = [payload]
+            test_url = urlunparse(parsed._replace(query=urlencode(q, doseq=True)))
+            resp = requester.get(test_url)
+            if not resp:
+                continue
+            body = resp.text.lower()
+            for err in NOSQL_ERRORS:
+                if err in body:
+                    console.print(f"[vuln]    !! NoSQL injection possible via {param}! Pattern: {err}[/vuln]")
+                    result["vulnerable"].append({"param": param, "payload": payload})
+                    result["findings"].append({
+                        "severity": "critical",
+                        "msg": f"NoSQL injection possible via param: {param}",
+                    })
+                    break
+    if not result["vulnerable"]:
+        console.print("[success]    + No NoSQL injection found[/success]")
+    return result

core/redirect.py

@@ -0,0 +1,39 @@
+from urllib.parse import urlparse, parse_qs, urlencode, urlunparse
+from utils.colors import console
+
+PAYLOADS = [
+    "https://evil.example.com",
+    "//evil.example.com",
+    "https://evil.example.com/%2f..",
+    "/\\evil.example.com",
+]
+
+def _build_url(parsed, param, value, original_query):
+    q = original_query.copy()
+    q[param] = [value]
+    return urlunparse(parsed._replace(query=urlencode(q, doseq=True)))
+
+def check_redirect(requester, url):
+    result = {"name": "Open Redirect", "findings": [], "vulnerable": []}
+    parsed = urlparse(url)
+    params = parse_qs(parsed.query)
+    if not params:
+        console.print("[dim]    i No parameters found, skipping[/dim]")
+        return result
+    console.print(f"[info]  -> Testing {len(params)} param(s) with {len(PAYLOADS)} payloads...[/info]")
+    for param in params:
+        console.print(f"[dim]    -> Param: {param}[/dim]")
+        for payload in PAYLOADS:
+            test_url = _build_url(parsed, param, payload, params)
+            resp = requester.get(test_url)
+            if not resp:
+                continue
+            loc = resp.headers.get("Location", "")
+            if resp.status_code in (301, 302, 303, 307, 308) and "evil.example.com" in loc:
+                console.print(f"[vuln]    !! VULNERABLE via {param}![/vuln]")
+                result["vulnerable"].append({"param": param, "payload": payload, "location": loc})
+                result["findings"].append({"severity": "high", "msg": f"Open Redirect via param: {param}"})
+                break
+    if not result["vulnerable"]:
+        console.print("[success]    + No open redirect found[/success]")
+    return result

core/requester.py

@@ -0,0 +1,44 @@
+import requests
+from requests.adapters import HTTPAdapter
+from urllib3.util.retry import Retry
+
+DEFAULT_TIMEOUT = 10
+DEFAULT_UA = "Mozilla/5.0 (X11; Linux x86_64) VpiXray/0.1"
+
+class Requester:
+    def __init__(self, timeout=DEFAULT_TIMEOUT, headers=None, proxy=None, verify=False, cookie=None):
+        self.timeout = timeout
+        self.session = requests.Session()
+        self.session.headers.update({"User-Agent": DEFAULT_UA})
+        if headers:
+            self.session.headers.update(headers)
+        if proxy:
+            self.session.proxies = {"http": proxy, "https": proxy}
+        if cookie:
+            for item in cookie.split(";"):
+                item = item.strip()
+                if "=" in item:
+                    k, v = item.split("=", 1)
+                    self.session.cookies.set(k.strip(), v.strip())
+        retries = Retry(total=2, backoff_factor=0.3, status_forcelist=[500, 502, 503, 504])
+        self.session.mount("http://", HTTPAdapter(max_retries=retries))
+        self.session.mount("https://", HTTPAdapter(max_retries=retries))
+        self.verify = verify
+
+    def get(self, url, **kwargs):
+        kwargs.setdefault("timeout", self.timeout)
+        kwargs.setdefault("verify", self.verify)
+        kwargs.setdefault("allow_redirects", False)
+        try:
+            return self.session.get(url, **kwargs)
+        except requests.RequestException:
+            return None
+
+    def post(self, url, **kwargs):
+        kwargs.setdefault("timeout", self.timeout)
+        kwargs.setdefault("verify", self.verify)
+        kwargs.setdefault("allow_redirects", False)
+        try:
+            return self.session.post(url, **kwargs)
+        except requests.RequestException:
+            return None

core/sensitive.py

@@ -0,0 +1,41 @@
+import os
+from utils.colors import console
+
+DEFAULT_FILES = [
+    ".env", ".git/config", ".git/HEAD", "backup.zip", "backup.tar.gz",
+    "config.php.bak", "wp-config.php.bak", ".DS_Store", "phpinfo.php",
+    "admin/", "robots.txt", "sitemap.xml", ".htaccess", "web.config",
+    "composer.json", "package.json", "Dockerfile", ".dockerignore",
+]
+
+def load_wordlist(path=None):
+    if path and os.path.isfile(path):
+        with open(path, "r", encoding="utf-8", errors="ignore") as f:
+            return [l.strip() for l in f if l.strip() and not l.startswith("#")]
+    return DEFAULT_FILES
+
+def check_sensitive(requester, base_url, wordlist_path=None):
+    files = load_wordlist(wordlist_path)
+    console.print(f"[info]  -> Testing {len(files)} sensitive paths...[/info]")
+    result = {"name": "Sensitive Files", "findings": [], "hits": []}
+    base = base_url.rstrip("/")
+    hits = 0
+    for i, path in enumerate(files, 1):
+        url = f"{base}/{path}"
+        console.print(f"[dim]    [{i}/{len(files)}] -> /{path}[/dim]")
+        resp = requester.get(url)
+        if resp and resp.status_code in (200, 301, 302, 403):
+            size = len(resp.content)
+            hits += 1
+            result["hits"].append({"url": url, "status": resp.status_code, "size": size})
+            sev = "high" if resp.status_code == 200 else "low"
+            console.print(f"[vuln]    !! HIT [{resp.status_code}] {url} ({size} bytes)[/vuln]")
+            result["findings"].append({
+                "severity": sev,
+                "msg": f"[{resp.status_code}] {url} ({size} bytes)",
+            })
+    if hits == 0:
+        console.print("[success]    + No sensitive files exposed[/success]")
+    else:
+        console.print(f"[error]    !! {hits} sensitive file(s) found[/error]")
+    return result